VA-003 Compare and configure secrets engines Practice Test 5 — 15 Questions

Question 1

A team is adopting Vault and wants to organize secrets by application and environment (e.g., production, staging). What is the best practice for secrets engine path naming?

Accepted Answer

Use hierarchical paths like 'app/env/secret'. Hierarchical paths like 'app/env/secret' are the best practice because they allow Vault's ACL policies to apply fine-grained access control at each level of the path. This structure maps directly to the organization's application and environment boundaries, enabling least-privilege access without complex policy rules. It also simplifies secret rotation and auditing by keeping related secrets logically grouped.

Answer

Use a single path like 'secrets/' for simplicity

Answer

Use the same path for all applications but separate with prefixes like 'app1-'

Answer

Use random UUIDs to avoid guessing

Question 2

A DevOps engineer configures the AWS secrets engine to assume a specific IAM role for generating dynamic credentials. The engine is enabled and the root configuration is set. Which parameter is essential in the role configuration to allow assuming the IAM role?

Accepted Answer

arn. The `arn` parameter is essential in the role configuration for the AWS secrets engine because it specifies the Amazon Resource Name (ARN) of the IAM role that Vault will assume to generate dynamic credentials. Without this parameter, Vault cannot identify which IAM role to assume via AWS STS AssumeRole API, making dynamic credential generation impossible.

Answer

role_type

Answer

credential_type

Answer

inline_policy

Question 3

A developer needs to generate a new certificate for an internal web service using the PKI secrets engine. A role named 'webserver' has been created. What is the correct command to issue the certificate?

Accepted Answer

vault write pki/issue/webserver common_name=web.example.com. The PKI secrets engine uses the path `pki/issue/<role_name>` to issue certificates. The `vault write` command sends a POST request to this endpoint with the required `common_name` parameter, which generates a new certificate signed by the CA associated with the 'webserver' role.

Answer

vault write pki/webserver/issue

Answer

vault write pki/webserver/cert common_name=web.example.com

Answer

vault read pki/cert/webserver

Question 4

An organization needs to store secrets with versioning support, allowing rollback to previous secret values. Which KV secrets engine version should be enabled?

Accepted Answer

KV v2. KV v2 is the correct choice because it provides versioning support for secrets, allowing users to retrieve and rollback to previous secret values. KV v1 stores secrets without versioning, and the Transit secrets engine is designed for encryption/decryption operations, not secret storage with versioning.

Answer

KV v3

Answer

KV v1

Answer

Transit secrets engine

Question 5

Which TWO of the following are benefits of using dynamic secrets engines (e.g., database, AWS) over static secrets?

Accepted Answer

Provides automatic rotation of credentials upon lease expiry. Option A is correct because dynamic secrets engines issue credentials with a defined lease/TTL, and when that lease expires (or is revoked), Vault automatically revokes and regenerates the credentials, delivering automatic rotation without manual intervention. Option E is correct because dynamic secrets are short-lived by design—each request generates unique, time-bound credentials—so any leaked credential has a limited window of usefulness, reducing the blast radius and risk of credential leakage. Options B, C, and D are incorrect: dynamic credentials do change (they are generated per lease and expire), they are not persistent or non-expiring, and Vault does not store dynamic secrets in plaintext in its data store—they are generated on demand and tracked by lease, not persisted as static plaintext values.

Answer

Simplifies the management of service accounts because credentials never change

Answer

Secrets are persistent and do not expire

Answer

Secrets are stored in plaintext in the Vault data store

Question 6

Which THREE steps are required to configure the database secrets engine for generating dynamic credentials?

Accepted Answer

Create a role that maps to the database user and permissions. Option E is correct because the database secrets engine must first be enabled (e.g., `vault secrets enable database`) before any connections or roles can be created. Option C is correct because you must configure a database connection (`vault write database/config/`) with the plugin, connection URL, and privileged credentials Vault uses to create dynamic users. Option A is correct because a role (`vault write database/roles/`) defines the SQL statements and mappings that generate the dynamic credentials with the appropriate permissions. Option B is not required for generating credentials, since it only governs authorization to read them, and Option D is optional tuning rather than a required configuration step.

Answer

Configure a policy to allow users to read credentials from the role

Answer

Tune the engine's default TTL

Question 7

An operator needs to enable the KV v2 secrets engine at the path 'team-alpha'. Which command should they run?

Accepted Answer

vault secrets enable -path=team-alpha kv-v2. The `vault secrets enable` command with the `-path` flag specifies the mount path as 'team-alpha', and `kv-v2` is the correct engine type for the KV v2 secrets engine. This command mounts the KV v2 engine at the desired path, enabling versioned key-value storage.

Answer

vault secrets enable kv-v2 team-alpha

Answer

vault secrets enable -path=team-alpha kv

Answer

vault secrets mount -path=team-alpha kv

Question 8

A development team wants to encrypt sensitive data before storing it in a database. They don't want to manage encryption keys themselves. Which secrets engine should they use?

Accepted Answer

Transit. The Transit secrets engine is designed to encrypt data in transit or at rest without exposing the encryption keys to the client. It performs cryptographic operations (encrypt/decrypt) on data sent to Vault, so the development team never manages or stores the keys themselves. This matches the requirement to avoid key management while encrypting sensitive data before database storage.

Answer

PKI

Answer

AWS

Answer

KV v2

Question 9

Refer to the exhibit. A Vault policy allows 'list' on 'secret/data/*'. A user tries to list keys under 'secret/data/' and gets a permission denied error. What is the most likely reason?

Accepted Answer

The path must be 'secret/metadata/*' for list. C is correct because in Vault, listing keys under a KV v2 secrets engine requires the 'list' capability on the 'secret/metadata/*' path, not 'secret/data/*'. The 'data' path is used for reading and writing actual secret values, while 'metadata' is the correct path for listing and deleting metadata (including key names). The policy only grants 'list' on 'secret/data/*', which does not cover the list operation on the metadata endpoint, resulting in a permission denied error.

Answer

The user's token has no default policy

Answer

The policy lacks 'read' capability

Answer

The secrets engine is not enabled

Question 10

Refer to the exhibit. A user deletes the current version of 'secret/myapp' using 'vault kv delete secret/myapp'. What happens to the version?

Accepted Answer

It is deleted and can be undeleted if not destroyed. With default delete_version_after=0s and max_versions=0, deleting a version marks it as deleted but does not destroy it. The version can be undeleted. The cas_required setting affects write operations, not delete. Permanent destruction requires a separate 'destroy' command or automatic cleanup if delete_version_after is set.

Answer

It is destroyed because cas_required is true

Answer

It is permanently deleted immediately

Answer

It is marked as deleted but can be undeleted because cas_required is true

Question 11

A company needs to automatically generate short-lived database credentials for developers. Which secrets engine should they use?

Accepted Answer

Database. The Database secrets engine is specifically designed to generate short-lived, dynamic database credentials on demand. It connects to a database and creates unique user accounts with configurable time-to-live (TTL) values, which are automatically revoked when the lease expires. This directly meets the requirement for automatically generating temporary database credentials for developers.

Answer

KV v2

Answer

AWS

Answer

Cubbyhole

Question 12

An organization uses the Transit secrets engine to encrypt sensitive files. They want to rotate the encryption key regularly without re-encrypting all existing files. Which feature allows this?

Accepted Answer

Key versioning. The Transit secrets engine in Vault supports key versioning, which allows you to rotate the encryption key by creating a new version while keeping older versions available for decryption of existing ciphertext. This means you can regularly rotate the key without needing to re-encrypt all previously encrypted files, as each ciphertext is tagged with the key version used to encrypt it.

Answer

Key derivation

Answer

Key ttl

Answer

Convergent encryption

Question 13

A Vault operator runs 'vault secrets list' and sees 'cubbyhole/' mounted. What is the purpose of this engine?

Accepted Answer

Store secrets that are isolated per token. The cubbyhole secrets engine creates a private, ephemeral storage space that is scoped to a single Vault token. Secrets written to cubbyhole are only readable by the same token that wrote them and are automatically destroyed when the token expires or is revoked, making it ideal for token-specific secrets like a one-time password or a temporary key.

Answer

Store secrets encrypted by the Transit engine

Answer

Store secrets that are replicated across clusters

Answer

Store secrets with high availability

Question 14

An operator configures a PKI role with allow_any_name=true and max_ttl=72h. A user requests a certificate with common_name='admin.example.com' and ttl=48h. What is the resulting TTL?

Accepted Answer

48h. The `max_ttl` setting on the PKI role defines the upper bound for certificate validity, but the user-requested TTL (48h) is within that bound (72h). The `allow_any_name=true` parameter permits any common name without restriction, so the certificate is issued with the requested TTL of 48h. The resulting TTL is the lesser of the requested TTL and the role's `max_ttl`, which in this case is 48h.

Answer

24h

Answer

72h

Answer

48h if allowed_domains matches, else error

Question 15

An administrator configures a database secrets engine with a role that uses 'creation_statements' and 'revocation_statements'. However, when a lease expires, the database user is not revoked. What is the most likely cause?

Accepted Answer

The revocation statement is incorrect. The most likely cause is that the revocation statement is incorrect. When a lease expires, Vault executes the SQL statement defined in `revocation_statements` to delete or disable the database user. If this statement has a syntax error, references a non-existent table, or fails to match the user created by `creation_statements`, the revocation will silently fail, leaving the user active in the database.

Answer

The connection string is invalid

Answer

The database user has been manually deleted

Answer

The lease duration is set too high